|
|
TCP |
6379 · REDIS
|
redis
|
Sonde port 6379/TCP
port 6379 tcp · via REDIS:6379 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Sonde protocole Redis
Émulateur
REDIS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_redis_probe
redis_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6379
Chemin / cible
—
Preuve honeypot — Sonde port 6379/TCP
Connexion détectée sur le port 6379 (TCP) du capteur simulé.
Service
REDIS
Redis
Sonde protocole Redis
Payload
GET / HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Saf
Pourquoi cette classification : Type « port_6379_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 45
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Saf
Requête brute (extrait)
GET / HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36 Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "2d4e4f415554482041757468656e7469636174696f6e2072657175697265642e0d0a",
"emulator_response_len": 34,
"bytes_in": 155,
"payload_entropy": 5.39077700682008,
"port_category": "registered",
"org": "IP Volume inc",
"service": "redis",
"app_proto": "redis",
"asn": 202425,
"country": "NL",
"dst_port": 6379,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 46,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5402c9916180e82dae639eb541e81260d5f1fe65",
"event_fingerprint": "9c536ce82edfb6f83700eeb7934e9ac49a41747b",
"classification_reason": "Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "redis",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bfcb5b3d76a59f47ba0c53c6e0c577bb",
"path_pattern_hash": "42eb67f6877c6439dbde87dd6ec1f324"
},
"target_context": {
"dst_port": 6379,
"service": "redis",
"service_name": "redis",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"request_sample": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"evidence": {
"request_sample": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"classification_reason": "Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "209ee69bc04492141c6ca6bfc816642be043c9c3",
"protocol_details": {
"redis_command_fr": "Sonde protocole Redis",
"payload_preview": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"port": 6379,
"service": "redis",
"service_label_fr": "REDIS"
},
"evidence_snippet": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"attack_vector": "port 6379 tcp \u00b7 via REDIS:6379 \u00b7 (sonde \/ probe)",
"target_port_label": "6379 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "redis",
"service_label_fr": "REDIS",
"dst_port": 6379,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Redis 7.0",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"redis_command_fr": "Sonde protocole Redis",
"payload_preview": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"port": 6379,
"service": "redis",
"service_label_fr": "REDIS"
},
"attack_vector": "port 6379 tcp \u00b7 via REDIS:6379 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"target_port_label": "6379 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "redis",
"service_banner": "Redis 7.0",
"service_os": "linux",
"dst_port": "6379"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_redis_probe",
"redis_emulated"
]
}
|
|
|
TCP |
9876 · ROCKETMQ
|
rocketmq
|
rocketmq probe
rocketmq probe · via ROCKETMQ:9876 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
ROCKETMQ
WAF
—
Recommandation
Surveiller
Tags
net_rocketmq_probe
rocketmq_emulated
rocketmq_payload
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9876
Chemin / cible
—
Service
ROCKETMQ
Payload
o kRH�#�:N�ⴂ/� T���y�h��� ="�� ��,��n�Y�bhl�(=':���oȢד���幐 (� � 9 k 5 =�� �#���' 3 g 2 / < ��
Pourquoi cette classification : Type « rocketmq_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Faible
· 35
Confiance : Confiance 74 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
Mq Rocketmq
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
o kRH�#�:N�ⴂ/� T���y�h��� ="�� ��,��n�Y�bhl�(=':���oȢד���幐 (�
� 9 k 5 =�� �#���' 3 g 2 / <
��
Requête brute (extrait)
o kRH�#�:N�ⴂ/� T���y�h��� ="�� ��,��n�Y�bhl�(=':���oȢד���幐 (� � 9 k 5 =�� �#���' 3 g 2 / < �� syndication.twimg.com� # ��g` B���<�XO�iD� ����=]�L� ��B��� ��LDt}����`~G�h?2�(qݍ*���(ى/�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "526f636b65744d510000000000000001",
"emulator_response_len": 16,
"bytes_in": 372,
"payload_entropy": 6.827478645460878,
"port_category": "registered",
"org": "IP Volume inc",
"service": "rocketmq",
"app_proto": "rocketmq",
"asn": 202425,
"country": "NL",
"dst_port": 9876,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "dcfa01e8d235953dad7040af4c74b3a53907f70e",
"event_fingerprint": "69f1f514dc809742bc860cf5cf92d1f1632ae0f0",
"classification_reason": "Type \u00ab rocketmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence": 0.74,
"classification_confidence": 0.74,
"precision_score": 83,
"precision_signals": [
"INT-mq-rocketmq",
"INT-upstream"
],
"kb_rule_ids": [
"INT-mq-rocketmq",
"INT-upstream"
],
"matched_patterns": [
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "rocketmq",
"risk_confidence_factor": 74,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b81809bfd53087ba03b6f3907cd619b",
"path_pattern_hash": "8b2a26f80b92afb16ccccb333b802d2c"
},
"target_context": {
"dst_port": 9876,
"service": "rocketmq",
"service_name": "rocketmq",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018\u0000\u0000\u0015syndication.twimg.com\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\ufffd\ufffd\u0001\u0019g`\u001e\u0004B\ufffd\ufffd\ufffd<\ufffdXO\ufffdiD\ufffd\u001d\ufffd\u0001\ufffd\ufffd\ufffd=]\ufffd\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\n\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\u0016`~G\u0007\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\u0003\ufffd(\u0649\/\u000f\u0007\ufffd",
"payload_snippet": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"classification_reason": "Type \u00ab rocketmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cede53b0cfc66d270345d4a6a12d1941735a3c53",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"port": 9876,
"service": "rocketmq",
"service_label_fr": "ROCKETMQ"
},
"evidence_snippet": "okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\"\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\n\ufffd9k5=\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd'3g2\/<\n\ufffd\ufffd",
"attack_vector": "rocketmq probe \u00b7 via ROCKETMQ:9876 \u00b7 (sonde \/ probe)",
"target_port_label": "9876 \u00b7 ROCKETMQ",
"emulator_service": "rocketmq",
"confidence_reason": "Confiance 74 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rocketmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab rocketmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "rocketmq",
"service_label_fr": "ROCKETMQ",
"dst_port": 9876,
"protocol_emulated": true,
"tags_summary": [
"INT-mq-rocketmq",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Mq Rocketmq",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rocketmq",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"port": 9876,
"service": "rocketmq",
"service_label_fr": "ROCKETMQ"
},
"attack_vector": "rocketmq probe \u00b7 via ROCKETMQ:9876 \u00b7 (sonde \/ probe)",
"evidence_snippet": "okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\"\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\n\ufffd9k5=\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd'3g2\/<\n\ufffd\ufffd",
"target_port_label": "9876 \u00b7 ROCKETMQ",
"emulator_service": "rocketmq",
"confidence_reason": "Confiance 74 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rocketmq",
"service_banner": "honeypot-rocketmq",
"service_os": "linux",
"dst_port": "9876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rocketmq_probe",
"rocketmq_emulated",
"rocketmq_payload",
"tls_clienthello"
]
}
|
|
|
TCP |
11211 · MEMCACHED
|
memcached
|
Sonde Memcached
memcached probe · via MEMCACHED:11211 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
MEMCACHED
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
memcached_emulated
memcached_payload
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11211
Chemin / cible
—
Service
MEMCACHED
Payload
GET / HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Saf
Pourquoi cette classification : Type « memcached_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Infra Memcached Stats
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Saf
Requête brute (extrait)
GET / HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36 Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "454e440d0a",
"emulator_response_len": 5,
"bytes_in": 155,
"payload_entropy": 5.39077700682008,
"port_category": "registered",
"org": "IP Volume inc",
"service": "memcached",
"app_proto": "memcached",
"asn": 202425,
"country": "NL",
"dst_port": 11211,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9729913b8cc57d8c7c74ebb8ef8ff39d243bcfd1",
"event_fingerprint": "2fcce8d4fd15e6ca50ec0235eeed2c6616def357",
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"INT-INFRA-memcached-stats",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-memcached-stats",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "memcached",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bfcb5b3d76a59f47ba0c53c6e0c577bb",
"path_pattern_hash": "549d36783f9e3c43618e715d78a40b3b"
},
"target_context": {
"dst_port": 11211,
"service": "memcached",
"service_name": "memcached",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"request_sample": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"evidence": {
"request_sample": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5021d7fc7034bc6ffd674bdad75632e434eb5081",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"port": 11211,
"service": "memcached",
"service_label_fr": "MEMCACHED"
},
"evidence_snippet": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"attack_vector": "memcached probe \u00b7 via MEMCACHED:11211 \u00b7 (sonde \/ probe)",
"target_port_label": "11211 \u00b7 MEMCACHED",
"emulator_service": "memcached",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "memcached",
"service_label_fr": "MEMCACHED",
"dst_port": 11211,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-memcached-stats",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Memcached Stats",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-memcached",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"port": 11211,
"service": "memcached",
"service_label_fr": "MEMCACHED"
},
"attack_vector": "memcached probe \u00b7 via MEMCACHED:11211 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Saf",
"target_port_label": "11211 \u00b7 MEMCACHED",
"emulator_service": "memcached",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "memcached",
"service_banner": "honeypot-memcached",
"service_os": "linux",
"dst_port": "11211"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"memcached_emulated",
"memcached_payload",
"mozi_pattern",
"net_memcached_probe"
]
}
|
|
|
TCP |
5000 · FLASK HTTP
|
flask-http
|
stun probe
stun probe · via FLASK HTTP:5000 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
FLASK-HTTP
WAF
—
Recommandation
Surveiller
Tags
flask_http_emulated
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5000
Chemin / cible
—
Service
FLASK HTTP
Payload
o kRH�#�:N�ⴂ/� T���y�h��� ="�� ��,��n�Y�bhl�(=':���oȢד���幐 (� � 9 k 5 =�� �#���' 3 g 2 / < ��
Pourquoi cette classification : Type « stun_probe » (signaux protocolaires) · confiance 44%
Confiance classification
44%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 44 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
o kRH�#�:N�ⴂ/� T���y�h��� ="�� ��,��n�Y�bhl�(=':���oȢד���幐 (�
� 9 k 5 =�� �#���' 3 g 2 / <
��
Requête brute (extrait)
o kRH�#�:N�ⴂ/� T���y�h��� ="�� ��,��n�Y�bhl�(=':���oȢד���幐 (� � 9 k 5 =�� �#���' 3 g 2 / < �� syndication.twimg.com� # ��g` B���<�XO�iD� ����=]�L� ��B��� ��LDt}����`~G�h?2�(qݍ*���(ى/�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
"emulator_response_len": 158,
"bytes_in": 372,
"payload_entropy": 6.827478645460878,
"port_category": "registered",
"org": "IP Volume inc",
"service": "flask-http",
"app_proto": "flask-http",
"asn": 202425,
"country": "NL",
"dst_port": 5000,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "01e979bab5cff3658f796a53a85df7f28227702e",
"event_fingerprint": "ca12ac856c9aabb53943b247ec13e1d2f927b610",
"classification_reason": "Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%",
"confidence": 0.44,
"classification_confidence": 0.44,
"precision_score": 52,
"precision_signals": [
"pat-0771"
],
"kb_rule_ids": [
"pat-0771"
],
"matched_patterns": [
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "flask-http",
"risk_confidence_factor": 44,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b81809bfd53087ba03b6f3907cd619b",
"path_pattern_hash": "2209b46920c1113b64f1b7d3129712ba"
},
"target_context": {
"dst_port": 5000,
"service": "flask-http",
"service_name": "flask-http",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018\u0000\u0000\u0015syndication.twimg.com\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\ufffd\ufffd\u0001\u0019g`\u001e\u0004B\ufffd\ufffd\ufffd<\ufffdXO\ufffdiD\ufffd\u001d\ufffd\u0001\ufffd\ufffd\ufffd=]\ufffd\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\n\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\u0016`~G\u0007\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\u0003\ufffd(\u0649\/\u000f\u0007\ufffd",
"payload_snippet": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"classification_reason": "Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cc70bce18027ec6bd377b4e08a4d148fd874eed4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"evidence_snippet": "okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\"\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\n\ufffd9k5=\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd'3g2\/<\n\ufffd\ufffd",
"attack_vector": "stun probe \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 44 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%",
"classification_reason_label_fr": "Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 44,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "flask-http",
"service_label_fr": "FLASK HTTP",
"dst_port": 5000,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-flask-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"port": 5000,
"service": "flask-http",
"service_label_fr": "FLASK HTTP"
},
"attack_vector": "stun probe \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\"\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\n\ufffd9k5=\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd'3g2\/<\n\ufffd\ufffd",
"target_port_label": "5000 \u00b7 FLASK HTTP",
"emulator_service": "flask-http",
"confidence_reason": "Confiance 44 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 44 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "flask_http",
"service_banner": "honeypot-flask-http",
"service_os": "linux",
"dst_port": "5000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"flask_http_emulated",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
3306 · MYSQL
|
mysql
|
Sonde MySQL
mysql probe · via MYSQL:3306 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
MYSQL
WAF
—
Recommandation
Surveiller
Tags
mysql_emulated
mysql_handshake
net_mysql_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3306
Chemin / cible
—
Service
MYSQL
Payload
o kRH�#�:N�ⴂ/� T���y�h��� ="�� ��,��n�Y�bhl�(=':���oȢד���幐 (� � 9 k 5 =�� �#���' 3 g 2 / < ��
Pourquoi cette classification : Poignée de main MySQL · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
Db Mysql Auth
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
o kRH�#�:N�ⴂ/� T���y�h��� ="�� ��,��n�Y�bhl�(=':���oȢד���幐 (�
� 9 k 5 =�� �#���' 3 g 2 / <
��
Requête brute (extrait)
o kRH�#�:N�ⴂ/� T���y�h��� ="�� ��,��n�Y�bhl�(=':���oȢד���幐 (� � 9 k 5 =�� �#���' 3 g 2 / < �� syndication.twimg.com� # ��g` B���<�XO�iD� ����=]�L� ��B��� ��LDt}����`~G�h?2�(qݍ*���(ى/�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400",
"emulator_response_len": 60,
"bytes_in": 372,
"payload_entropy": 6.827478645460878,
"port_category": "registered",
"org": "IP Volume inc",
"service": "mysql",
"app_proto": "mysql",
"asn": 202425,
"country": "NL",
"dst_port": 3306,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15
},
"risk_score": 48,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a246aa7fbaca41c12f7f0beae72af258e6547eca",
"event_fingerprint": "7e64d2ea7efbfd080eb620b69c685e7503a67a61",
"classification_reason": "Poign\u00e9e de main MySQL \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-DB-mysql-auth",
"INT-upstream"
],
"kb_rule_ids": [
"INT-DB-mysql-auth",
"INT-upstream"
],
"matched_patterns": [
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "mysql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 202425,
"org": "IP Volume inc",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b81809bfd53087ba03b6f3907cd619b",
"path_pattern_hash": "f92b97805e8111d6d69ad0f096b65c87"
},
"target_context": {
"dst_port": 3306,
"service": "mysql",
"service_name": "mysql",
"risk_score": 48
},
"payload_snippet": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018\u0000\u0000\u0015syndication.twimg.com\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\ufffd\ufffd\u0001\u0019g`\u001e\u0004B\ufffd\ufffd\ufffd<\ufffdXO\ufffdiD\ufffd\u001d\ufffd\u0001\ufffd\ufffd\ufffd=]\ufffd\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\n\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\u0016`~G\u0007\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\u0003\ufffd(\u0649\/\u000f\u0007\ufffd",
"payload_snippet": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"classification_reason": "Poign\u00e9e de main MySQL \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "389a19611ac26e5f5da9e93a575237eb0d66d4c0",
"protocol_details": {
"mysql_auth_fr": "Handshake MySQL (auth)",
"payload_preview": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"port": 3306,
"service": "mysql",
"service_label_fr": "MYSQL"
},
"evidence_snippet": "okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\"\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\n\ufffd9k5=\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd'3g2\/<\n\ufffd\ufffd",
"attack_vector": "mysql probe \u00b7 via MYSQL:3306 \u00b7 (sonde \/ probe)",
"target_port_label": "3306 \u00b7 MYSQL",
"emulator_service": "mysql",
"confidence_reason": "Confiance 95 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Poign\u00e9e de main MySQL \u00b7 confiance 95%",
"classification_reason_label_fr": "Poign\u00e9e de main MySQL \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "mysql",
"service_label_fr": "MYSQL",
"dst_port": 3306,
"protocol_emulated": true,
"tags_summary": [
"INT-DB-mysql-auth",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Db Mysql Auth",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "8.0.32-MySQL",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mysql_auth_fr": "Handshake MySQL (auth)",
"payload_preview": "\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\"\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd'\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000<\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018",
"port": 3306,
"service": "mysql",
"service_label_fr": "MYSQL"
},
"attack_vector": "mysql probe \u00b7 via MYSQL:3306 \u00b7 (sonde \/ probe)",
"evidence_snippet": "okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\"\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=':\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\n\ufffd9k5=\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd'3g2\/<\n\ufffd\ufffd",
"target_port_label": "3306 \u00b7 MYSQL",
"emulator_service": "mysql",
"confidence_reason": "Confiance 95 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mysql",
"service_banner": "8.0.32-MySQL",
"service_os": "linux",
"dst_port": "3306"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mysql_emulated",
"mysql_handshake",
"net_mysql_probe",
"tls_clienthello"
]
}
|